{"id":"CVE-2026-125340","kind":"vulnerability","aliases":["CVE-2026-125340","GHSA-hq84-x37p-j6q5"],"related":[],"title":"Winter: Reflected XSS through the search query parameter in the backend Table widget","description":"### Impact\n\nAffected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `<script type=\"text/template\">` block in the backend Table widget partial (`modules/backend/widgets/table/partials/_table.php`):\n\n```php\nvalue=\"<?= get('search') ?>\"\n```\n\n`<script>` is an HTML raw-text context, so the surrounding `value=\"…\"` attribute quoting is not a parser boundary. A literal `</script>` in the query string terminates the template element early, and everything after it is parsed as ordinary markup in the backend document.\n\nAny backend page rendering a Table or DataTable widget is a sink. The value is read from the global request through the `get()` helper, which — unlike `post()` — is not restricted by HTTP method, so a plain top-level `GET` navigation is sufficient. The template is also emitted unconditionally by the partial, so widgets using the default `searching: false` configuration are equally affected.\n\nIn Winter core the reachable route is the **Editor Settings** form (`/backend/system/settings/update/winter/backend/editor`), which renders six `datatable` fields and is gated by `backend.manage_editor` — assigned by default to the built-in Developer role. Third-party plugins using the `datatable` form widget, or the Table widget directly, expose the same sink on their own pages.\n\nAn attacker who induces a signed-in backend user to follow a crafted link executes script in that user's authenticated backend origin. The injected script can read the CSRF token published in the backend layout's `<meta name=\"csrf-token\">` element and issue credentialed requests as the victim, bounded only by that user's permissions. Because the core sink requires `backend.manage_editor`, the practical victim is a Developer-role user or superuser — who can edit CMS templates, so script running in that session can chain to server-side code execution.\n\nThis is not a permission bypass: the victim must already be authorised for the page, and the attacker gains no permission the victim does not hold.\n\nTo actively exploit this issue, an attacker needs no account of their own, but does need an authenticated backend user with access to a page rendering a Table or DataTable widget to follow an attacker-supplied link.\n\n### Patches\n\nThe `search` value is now HTML-encoded on output, matching every other value rendered by the same partial and the equivalent handling in the backend Search widget (`modules/backend/widgets/search/partials/_search.php`):\n\n```php\nvalue=\"<?= e(get('search')); ?>\"\n```\n\nThis removes the raw-text terminator: the browser can no longer encounter an attacker-supplied literal `</script>` while tokenising the document. The template is subsequently parsed once by jQuery when the toolbar is built, so an encoded payload resolves to an inert attribute string rather than markup.\n\nRegression coverage was added in `modules/backend/tests/widgets/TableSearchEscapingTest.php`, covering plain, mixed-case (`</ScRiPt>`) and whitespace-bearing (`</script >`) terminators, both `searching` states, and preservation of ordinary and Unicode search text.\n\nThis security issue has been fixed in [v1.2.14](https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14).\n\n### Workarounds\n\nIf you cannot upgrade, apply https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14 manually — in `modules/backend/widgets/table/partials/_table.php`, change:\n\n```php\nvalue=\"<?= get('search') ?>\"\n```\n\nto:\n\n```php\nvalue=\"<?= e(get('search')); ?>\"\n```\n\nA restrictive Content Security Policy served at the web server or reverse proxy can reduce practical exploitability, but it is not a substitute for the fix: Winter's backend ships inline scripts, so a policy permissive enough to run the backend may still permit an injected execution primitive.\n\n### References\n\nCredit to Awwader ([@NRAwwad](https://github.com/NRAwwad)) for reporting the issue.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n- Email us at [hello@wintercms.com](mailto:hello@wintercms.com)","summary":"The backend Table widget in Winter CMS prints the search query parameter without HTML encoding inside a script template block, so a crafted link can break out and run script. An attacker who gets a signed-in backend user to open the link can run script in that user's backend session and act with their permissions.","severity":"medium","cvss":4.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"winter/wn-backend-module","fixed":["1.2.14"],"affected":">= 1.0.420, <= 1.2.13","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["backend-widgets","cwe-79","package","php","self-hosted","winter-cms"],"not_affected_if":["no-backend-table-widget","version-outside-range"],"how_to_check":"- Check the installed version of `composer show winter/wn-backend-module` and see whether it falls in `>= 1.0.420, <= 1.2.13`.\n- Look at `modules/backend/widgets/table/partials/_table.php` and see whether the search value is printed with `get('search')` and no `e()` call.","fix":"- `winter/wn-backend-module`: upgrade to `1.2.14`.\n- If upgrading is not possible, the advisory's workaround is to wrap the search value in `e()` in `modules/backend/widgets/table/partials/_table.php`.","status":"open","published_at":"2026-08-20T18:45:04+00:00","first_seen_at":"2026-11-10T20:10:42+00:00","triaged_at":"2026-11-10T20:12:36+00:00","updated_at":"2026-11-10T20:12:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T20:12:36Z","model":"claude-haiku-5-5","output":{"fix":"- `winter/wn-backend-module`: upgrade to `1.2.14`.\n- If upgrading is not possible, the advisory's workaround is to wrap the search value in `e()` in `modules/backend/widgets/table/partials/_table.php`.","reach":"internet","title":"Winter CMS: reflected XSS via search parameter in backend table widget","impact":"medium","summary":"The backend Table widget in Winter CMS prints the search query parameter without HTML encoding inside a script template block, so a crafted link can break out and run script. An attacker who gets a signed-in backend user to open the link can run script in that user's backend session and act with their permissions.","audience":"developers","category":"package","nicknames":[],"who_cares":["winter-cms","self-hosted","backend-widgets","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in victim's backend session and can issue privileged requests","analyst_note":"","how_to_check":"- Check the installed version of `composer show winter/wn-backend-module` and see whether it falls in `>= 1.0.420, <= 1.2.13`.\n- Look at `modules/backend/widgets/table/partials/_table.php` and see whether the search value is printed with `get('search')` and no `e()` call.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-backend-table-widget"],"who_is_affected":"Any Winter CMS install whose backend pages render a Table or DataTable widget is exposed, and the Editor Settings form in core is a reachable example. The practical victims are backend users with access to those pages, most likely Developer-role users or superusers, because the core sink requires backend.manage_editor. Sites that do not run the backend module at the affected versions can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000932,"input_tokens":5955,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125340':16A,24A '-2026':15A,23A '-79':30B '/backend/system/settings/update/winter/backend/editor':209C '/nrawwad))':606C '/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14':536C '/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14).':527C 'access':390C 'account':378C 'act':93B 'activ':370C 'add':493C 'affect':98C,197C 'alreadi':352C 'also':181C 'appli':533C 'assign':221C 'attack':70B,254C,360C,375C,404C,457C 'attacker-suppli':403C,456C 'attribut':485C 'authent':274C,386C 'authoris':354C 'awwad':602C 'backend':11A,27B,40B,77B,90B,133C,136C,261C,275C,288C,387C,433C,579C,591C 'backend-widget':26B 'backend.manage':219C,311C 'bear':504C 'block':58B 'bound':299C 'break':64B 'browser':450C 'built':227C,476C 'built-in':226C 'bypass':348C 'cannot':531C 'case':500C 'chain':336C 'chang':540C 'cms':38B,45B,102C,327C 'code':341C 'comment':620C 'configur':194C 'content':553C 'core':200C,308C 'cover':496C 'coverag':491C 'craft':61B,266C 'credenti':294C 'credit':600C 'csrf':283C 'cve':14A,22A 'cwe':29B 'datat':142C,213C,237C,398C 'default':191C,223C 'develop':229C,319C 'developer-rol':318C 'direct':244C 'document':134C,463C 'e':439C,548C 'earli':121C 'edit':326C 'editor':206C,220C,312C 'element':120C,291C 'emit':182C 'encod':53B,110C,415C,479C 'encount':454C 'enough':587C 'equal':196C 'equival':429C 'everi':419C 'everyth':123C 'execut':268C,342C,597C 'exploit':371C,567C 'expos':245C 'fals':193C 'field':214C 'fix':522C,576C 'follow':264C,401C 'form':208C,238C 'gain':361C 'gate':217C 'get':72B,157C,174C,440C,543C,549C 'ghsa':18A 'ghsa-hq84-x37p-j6q5':17A 'github.com':526C,535C,605C 'github.com/nrawwad))':604C 'github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14':534C 'github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14).':525C 'global':153C 'handl':430C 'helper':158C 'hold':368C 'host':35B 'hq84':19A 'html':52B,109C,414C 'html-encod':413C 'http':166C 'impact':97C 'induc':256C 'inert':484C 'inform':613C 'inject':278C,596C 'inlin':581C 'insid':54B,111C 'issu':293C,373C,519C,610C 'j6q5':21A 'jqueri':471C 'layout':289C 'level':173C 'link':62B,82B,267C,406C 'liter':459C 'longer':453C 'manual':537C 'markup':130C,489C 'match':418C 'may':592C 'method':167C 'mix':499C 'mixed-cas':498C 'modules/backend/tests/widgets/tablesearchescapingtest.php':495C 'modules/backend/widgets/search/partials/_search.php':436C 'modules/backend/widgets/table/partials/_table.php':539C 'must':351C 'navig':175C 'need':376C,384C 'nrawwad':603C 'open':80B 'ordinari':129C,512C 'origin':276C 'output':417C 'packag':31B 'page':137C,252C,357C,393C 'paramet':8A,50B,107C 'pars':127C,468C 'parti':233C 'partial':186C,426C 'patch':407C 'payload':480C 'permiss':96B,305C,347C,363C,586C 'permit':594C 'php':32B,437C,541C,546C 'plain':170C,497C 'plugin':234C 'polici':555C,585C 'post':161C 'practic':314C,566C 'preserv':510C 'primit':598C 'print':46B 'proxi':563C 'publish':285C 'queri':7A,49B,106C,115C 'question':618C 'rather':487C 'raw':446C 'raw-text':445C 'reachabl':202C 'read':150C,281C 'reduc':565C 'refer':599C 'reflect':2A 'regress':490C 'remov':443C 'render':103C,138C,211C,394C,422C 'report':608C 'request':154C,295C 'requir':310C 'resolv':481C 'restrict':164C,552C 'revers':562C 'role':230C,320C 'rout':203C 'run':67B,84B,331C,589C 'script':56B,68B,85B,269C,279C,330C,582C 'search':6A,48B,105C,192C,409C,434C,441C,507C,515C,544C,550C 'secur':518C,554C 'self':34B 'self-host':33B 'serv':556C 'server':339C,560C 'server-sid':338C 'session':91B,334C 'set':207C 'ship':580C 'side':340C 'sign':75B,259C 'signed-in':74B,258C 'sink':146C,248C,309C 'six':212C 'state':508C 'still':593C 'string':116C,486C 'subsequ':467C 'substitut':573C 'suffici':177C 'superus':323C 'suppli':405C,458C 'tabl':12A,41B,140C,242C,396C 'templat':57B,119C,179C,328C,465C 'termin':117C,448C,505C 'text':447C,516C 'third':232C 'third-parti':231C 'token':284C 'tokenis':461C 'toolbar':474C 'top':172C 'top-level':171C 'uncondit':183C 'unicod':514C 'unlik':160C 'upgrad':532C 'use':189C,235C 'user':78B,88B,262C,272C,303C,321C,388C 'v1.2.14':524C 'valu':148C,410C,421C,438C,542C,547C 'version':99C 'victim':298C,315C,350C,365C 'web':559C 'whitespac':503C 'whitespace-bear':502C 'widget':13A,28B,42B,143C,188C,239C,243C,399C,435C 'winter':1A,37B,44B,101C,199C,577C 'winter-cm':36B 'winter/wn-backend-module':25A 'without':51B,108C 'workaround':528C 'x37p':20A 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Any Winter CMS install whose backend pages render a Table or DataTable widget is exposed, and the Editor Settings form in core is a reachable example. The practical victims are backend users with access to those pages, most likely Developer-role users or superusers, because the core sink requires backend.manage_editor. Sites that do not run the backend module at the affected versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["winterwnbackendmodule"],"ptokens":["backend","module","winter","wn"],"labels":["backendwidgets","composer","cwe79","medium","package","php","selfhosted","wintercms"],"campaign_type":null,"search_a":"'-125340':16A,24A '-2026':15A,23A 'backend':11A 'cve':14A,22A 'ghsa':18A 'ghsa-hq84-x37p-j6q5':17A 'hq84':19A 'j6q5':21A 'paramet':8A 'queri':7A 'reflect':2A 'search':6A 'tabl':12A 'widget':13A 'winter':1A 'winter/wn-backend-module':25A 'x37p':20A 'xss':3A","search_b":"'-79':30B 'act':93B 'attack':70B 'backend':27B,40B,77B,90B 'backend-widget':26B 'block':58B 'break':64B 'cms':38B,45B 'craft':61B 'cwe':29B 'encod':53B 'get':72B 'host':35B 'html':52B 'insid':54B 'link':62B,82B 'open':80B 'packag':31B 'paramet':50B 'permiss':96B 'php':32B 'print':46B 'queri':49B 'run':67B,84B 'script':56B,68B,85B 'search':48B 'self':34B 'self-host':33B 'session':91B 'sign':75B 'signed-in':74B 'tabl':41B 'templat':57B 'user':78B,88B 'widget':28B,42B 'winter':37B,44B 'winter-cm':36B 'without':51B","search_c":"'/backend/system/settings/update/winter/backend/editor':209C '/nrawwad))':606C '/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14':536C '/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14).':527C 'access':390C 'account':378C 'activ':370C 'add':493C 'affect':98C,197C 'alreadi':352C 'also':181C 'appli':533C 'assign':221C 'attack':254C,360C,375C,404C,457C 'attacker-suppli':403C,456C 'attribut':485C 'authent':274C,386C 'authoris':354C 'awwad':602C 'backend':133C,136C,261C,275C,288C,387C,433C,579C,591C 'backend.manage':219C,311C 'bear':504C 'bound':299C 'browser':450C 'built':227C,476C 'built-in':226C 'bypass':348C 'cannot':531C 'case':500C 'chain':336C 'chang':540C 'cms':102C,327C 'code':341C 'comment':620C 'configur':194C 'content':553C 'core':200C,308C 'cover':496C 'coverag':491C 'craft':266C 'credenti':294C 'credit':600C 'csrf':283C 'datat':142C,213C,237C,398C 'default':191C,223C 'develop':229C,319C 'developer-rol':318C 'direct':244C 'document':134C,463C 'e':439C,548C 'earli':121C 'edit':326C 'editor':206C,220C,312C 'element':120C,291C 'emit':182C 'encod':110C,415C,479C 'encount':454C 'enough':587C 'equal':196C 'equival':429C 'everi':419C 'everyth':123C 'execut':268C,342C,597C 'exploit':371C,567C 'expos':245C 'fals':193C 'field':214C 'fix':522C,576C 'follow':264C,401C 'form':208C,238C 'gain':361C 'gate':217C 'get':157C,174C,440C,543C,549C 'github.com':526C,535C,605C 'github.com/nrawwad))':604C 'github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14':534C 'github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14).':525C 'global':153C 'handl':430C 'helper':158C 'hold':368C 'html':109C,414C 'html-encod':413C 'http':166C 'impact':97C 'induc':256C 'inert':484C 'inform':613C 'inject':278C,596C 'inlin':581C 'insid':111C 'issu':293C,373C,519C,610C 'jqueri':471C 'layout':289C 'level':173C 'link':267C,406C 'liter':459C 'longer':453C 'manual':537C 'markup':130C,489C 'match':418C 'may':592C 'method':167C 'mix':499C 'mixed-cas':498C 'modules/backend/tests/widgets/tablesearchescapingtest.php':495C 'modules/backend/widgets/search/partials/_search.php':436C 'modules/backend/widgets/table/partials/_table.php':539C 'must':351C 'navig':175C 'need':376C,384C 'nrawwad':603C 'ordinari':129C,512C 'origin':276C 'output':417C 'page':137C,252C,357C,393C 'paramet':107C 'pars':127C,468C 'parti':233C 'partial':186C,426C 'patch':407C 'payload':480C 'permiss':305C,347C,363C,586C 'permit':594C 'php':437C,541C,546C 'plain':170C,497C 'plugin':234C 'polici':555C,585C 'post':161C 'practic':314C,566C 'preserv':510C 'primit':598C 'proxi':563C 'publish':285C 'queri':106C,115C 'question':618C 'rather':487C 'raw':446C 'raw-text':445C 'reachabl':202C 'read':150C,281C 'reduc':565C 'refer':599C 'regress':490C 'remov':443C 'render':103C,138C,211C,394C,422C 'report':608C 'request':154C,295C 'requir':310C 'resolv':481C 'restrict':164C,552C 'revers':562C 'role':230C,320C 'rout':203C 'run':331C,589C 'script':269C,279C,330C,582C 'search':105C,192C,409C,434C,441C,507C,515C,544C,550C 'secur':518C,554C 'serv':556C 'server':339C,560C 'server-sid':338C 'session':334C 'set':207C 'ship':580C 'side':340C 'sign':259C 'signed-in':258C 'sink':146C,248C,309C 'six':212C 'state':508C 'still':593C 'string':116C,486C 'subsequ':467C 'substitut':573C 'suffici':177C 'superus':323C 'suppli':405C,458C 'tabl':140C,242C,396C 'templat':119C,179C,328C,465C 'termin':117C,448C,505C 'text':447C,516C 'third':232C 'third-parti':231C 'token':284C 'tokenis':461C 'toolbar':474C 'top':172C 'top-level':171C 'uncondit':183C 'unicod':514C 'unlik':160C 'upgrad':532C 'use':189C,235C 'user':262C,272C,303C,321C,388C 'v1.2.14':524C 'valu':148C,410C,421C,438C,542C,547C 'version':99C 'victim':298C,315C,350C,365C 'web':559C 'whitespac':503C 'whitespace-bear':502C 'widget':143C,188C,239C,243C,399C,435C 'winter':101C,199C,577C 'without':108C 'workaround':528C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-19T22:08:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hq84-x37p-j6q5","url":"https://github.com/advisories/GHSA-hq84-x37p-j6q5","severity":"medium","published_at":"2026-08-20T18:45:04+00:00","modified_at":"2026-11-10T20:07:25+00:00","first_seen_at":"2026-11-10T20:10:42+00:00","fetched_at":"2026-11-10T20:56:29+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-125340","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125340","severity":null,"published_at":"2026-11-10T20:19:08+00:00","modified_at":"2026-11-10T20:19:08+00:00","first_seen_at":"2026-11-10T20:46:04+00:00","fetched_at":"2026-11-10T20:46:17+00:00","note":null}],"documents":[{"id":117789,"url":"https://api.github.com/repos/wintercms/winter/security-advisories/GHSA-hq84-x37p-j6q5","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":117790,"url":"https://github.com/wintercms/winter/security/advisories/GHSA-hq84-x37p-j6q5","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-08-19T22:08:53+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":117791,"url":"https://github.com/wintercms/winter/commit/1b6397654124fb44a6abf6f3782b6a1d746cef14","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117757,"url":"https://github.com/wintercms/winter/releases/tag/v1.2.14","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}